Internal Audit from a developed country perspective– some possible lessons.

1. Internal Audit from a developed country perspective– some possible lessons. Noel Hepworth Chartered Institute of Public Finance and Accountancy

2. Objectives of the Session – to discuss • The critical issues – what is it that makes internal audit work well in a developed country? • Good governance • The role of management • Internal audit quality and management • Separation of the management and political roles • Some differences between developed country and transition economy countries 2

3. The critical issues – what makes internal audit (IA) work well? (1) • Internal control systems sound and relevant to current needs. • Fraud and corruption relatively limited. • Standards of governance and ethical behaviour high. • Effective reporting arrangements with action taken. • High quality management – well motivated. (Poor quality management can be removed.) • Management accepts full responsibility for internal control and publishes annually a statement on the quality of the internal control system. • Clear distinction between roles of officials and politicians 3

4. The critical issues – what makes internal audit (IA) work well? (2) • Management has authority to manage, i.e. to make decisions about the use of resources: sees IA as a valuable supporting tool. • IA integrated into each public organisation, with only standards set by MoF. • Strong, relevant financial and management accounting systems. • Professional well trained staff. • Staff do not change on a change of government. • Forward planning system that effectively defines risk: it sets performance and financial targets. • Strong and effective Parliamentary and ext. audit oversight. 4

5. Good governance is essential to good public management: it means • Focussing on the organisation’s purpose and outcomes for citizens and users. • Performing effectively with clarity about functions and roles: i.e. those of the politicians, the executives and their different relationships with the public. • Promoting values for the organisation and demonstrating those values. • Taking informed transparent decisions and managing risk • Developing the capacity and capability of the governing body to be effective. • Engaging stakeholders and making accountability real. 5

6. How does this impact on IA? The governing body (board/council/mayor/minister) should ensure that effective arrangements are in place to: • provide assurance on risk management, governance and internal control. The governing body should be independently advised by: • an audit committee chaired by an independent non-executive member; • an IA service operating in accordance with Internal Audit Standards. The executive is responsible for the operational arrangements for risk management, governance and internal control: should publish a statement annually on the quality of the internal control arrangements. Note: The audit committee may include politicians but should include crucially independent persons and top management or top management should always be present. 6

7. The role of management The quality of governance depends upon the quality of political leadership and the management arrangements for the delivery of policy and/or services. Underpinning principles of good governance are: openness, accountability and integrity. • An IA role is to examine the systems of governance. IA cannot provide a substitute for poor management. IA is a service to management (not to the political leadership) and its success depends upon the quality of management. • Political leadership provides the ‘drive’ for good governance. 7

8. IA and management Effectiveness of IA is a function of the quality of management: • advanced IA techniques and approaches are of no value if management has no capacity to use the results and systems are weak or irrelevant; • IA must not isolate itself from, or be seen as a threat to, management; • management needs to accept and understand its responsibilities for internal control; • management needs to understand the role of audit and this role is not another form of ‘control’. 8

9. IA quality and management (1) IA has to ‘add value’ – without that it will be ineffective. IA main role is to support management: therefore its agenda needs to be agreed with top management: • risk is a key issue for management: IA should address risk but IA perception of risk can be very narrow unless it works with management; • risk has to be derived from the strategic plan – no strategic plan, then no understanding of the real risks; • main risks are about achieving the planned objectives and planned performance for the organisation. To add value IA has to address those issues that are of prime concern to management, i.e. risk and governance – that is why it has to work with management. 9

10. IA quality and management (2) IA must be professionally managed and be technically competent: • senior audit management must understand the operational environment of the organisation – audit does not operate in a vacuum; • ideally audit staff should have line management experience and staff should not spend all their career in IA; (without that they will have no understanding of what line management really means); • quality in audit activity and reporting is essential otherwise audit reports and recommendations will be ignored; (that means a thorough understanding of technical standards and independent quality reviews) • IA must work within the organisation, that is, it must not seek to use external levers to pursue its objectives (except in extremis); • auditors need behavioural and technical skills and at senior level management skills. 10

11. Separation of management and political roles Two traditions: with one, senior executive management changes with the government: with the other a clear separation exists with no management change. For IA, there should be no change on a change of government because: • Change politicises IA • Politicisation reduces independence • Change removes continuity of skill and experience • As a result creation of a professional IA is difficult • Politicians need to ensure that independent advice on governance is available to them. Where senior management change occurs, IA provides stability and has key educational role on governance. 11

12. Differences between developed and transition economy countries • Separation of official/political roles • Management accepts responsibility for internal control • High quality, confident management • Robust and relevant financial/internal control systems • High levels of integrity and ethical standards • Strong corporate governance and accountability arrangements • High quality planning and risk assessment • IA reports to top management (and also has access to an Audit Committee) The IA model assumes the above conditions: can it be made to work well if they do not apply? Should the focus of IA be different if weak systems, governance etc exist? 12